Toshiba 500GB out of DVR Locked

[jarogill]

Hi, so i got these 2 hdd's that were taken out of a DVR from sagemcom, they are locked.
i tried before with some tools but no success...

Model: MQ01ABD050VS

Thanks!

[DR-Kiev]

What is terminal log?

[Moltke]

What is terminal log?

and what should be in the terminal ?

[professor_jonny]

There are a few master passwords on drives, there is also a few tools around on xbmc4xbox forums for this as the hdd in the original xbox had a similar setup to avoid tampering.
but I have never seen any Toshiba specific drives mentioned.

[eyal]

Hi,

I have some of this model as well, anyone managed to get this unlocked?

[tonny]

Hi, so i got these 2 hdd's that were taken out of a DVR from sagemcom, they are locked.
i tried before with some tools but no success...

Model: MQ01ABD050VS

Thanks!

Can you need to use the toolkit PC3K, DFL, MRT
To break the hard drive password

[eyal]

I have MRT but it can't handle this lock. it's not conventional password, it's more than that!

[tonny]

I have MRT but it can't handle this lock. it's not conventional password, it's more than that!

Can you update New Version 160528

[eyal]

I have MRT but it can't handle this lock. it's not conventional password, it's more than that!

Can you update New Version 160528

Update MRT software? I'm on last version, updated 2 days ago.

[eyal]

Maybe you should start by dumping the CPs of your drive and compare with CPs of the same unlocked drive ?

Does the drive report as ATA locked or you can't just scan the user area ?

This is what I get:

[jermy]

Maybe you should start by dumping the CPs of your drive and compare with CPs of the same unlocked drive ?

Does the drive report as ATA locked or you can't just scan the user area ?

This is what I get:

Why do you think its locked and not a head(s) problem ?

[eyal]

I can't scan surface, sectors can't be read, also CP and ROM are not accessible. I have 6 different drives, all are showing in HDSetninel as 100% health, it's not head problem, it's some sort of lock made by sagemcom Set top boxes, there are also HGST and WD drives locked by this same technique.

[Amarbir[CDR-Labs]]

I can't scan surface, sectors can't be read, also CP and ROM are not accessible. I have 6 different drives, all are showing in HDSetninel as 100% health, it's not head problem, it's some sort of lock made by sagemcom Set top boxes, there are also HGST and WD drives locked by this same technique.

WD should be easy to unlock by editing mod 02.
Can you dump the ROM chip using external programmer ?
I would start by dumping the ROM image and then extract the CPs out of it (if there is a module directory on ROM). Then you can compare with one unlocked drive of the same model.
If you can't get to the ROM then you can't edit a thing. I don't think it will be as easy to unlock as the WD drive.
HGST you will need to dump the NVRam but i don't think that the MRT Pro/PC3K will allow for you to do so as the drive will prevent access to it (locked). You can use "other methods" like external programmer as well.

Well,
Only Few Mods Are There on Platter in toshiba ,Like G List Etc .So Reading ROM Using a Tool And Then Extracting CP Should Be Good Enough If Other Working HDD and Its CP Are available For comparison .What i cannot digest is that why CP's cannot be read .Hopefully a Better Tool Like PC3k might work then mrt and dfl

[fzabkar]

IIUC, Toshiba's firmware code is entirely on the PCB. The drive only needs to access the SA for certain data modules (SMART, G-list, P-list, etc). Also, the CPs seem to be data modules rather than code. Shouldn't it then be possible to transfer the patient's CPs to a donor ROM, even if the firmware isn't exactly the same version? I mean, it's not like WD or Seagate drives where you need to match ROM code with SA overlays, or is it? Assuming that the lock is activated by the code in the patient but ignored by the code in the donor, then a CP transfer to a regular non-Sagem ROM should unlock the drive.

[fzabkar]

Video Stream HDD - MQ01ABD100VS / MQ01ABD050VS / MQ01ABD032VS / MQ01ABD025VS:
http://toshiba.semicon-storage.com/us/p ... xxxvs.html

Toshiba's MQ01ABD-VS series adds security authentication to our MQ01ABD-V Series. The Security authentication feature is for Digital Rights Management (DRM) used in STB applications. The MQ01ABD-VS series is suitable for video editing, set-top-box (STB), digital video recorders (DVR) and network video recorders (NVR) applications where large capacity, low power and low acoustics are critical.

Perhaps one could adapt a ROM from a MQ01ABD-V HDD.

[g0dzax]

I highly doubt the ROM can be flashed. You don't have acces to the CP's, they're only listed as available, you can't edit sectors, you can do pretty much nothing on it. I'll post later some screenshots from PC3K, and also terminal is locked, enter prompt doesn't work and it actually continuously gives the message to connect the PC-adapter(terminal) to it, even tough it is connected. The only way around I see it is you can short some channels to jump over the platter readings, but I'd need some documentation regarding this drive's PCB details, which I haven't found. fzabkar had a nice idea with the flashing of the ROM, but like I said, on PC3K I doubt you can do it. Only with a stock Toshiba tool maybe to update the firmware. In this regard, I might get my hands on one of those drives. On another note, if anyone has some information regarding the boot-up sequence and the way Toshiba drives load the ROM and CP's, please do post a link or something.

[g0dzax]

It would be cool if someone actually managed to dump the ROM or CP's, so we could compare them to an unlocked drive of these series. If there is any kind of suggestion regarding how to do that, do post it. Meanwhile, I'm attaching the RAM (read through terminal and ATA), ROM and CP's I got from an ABD unlocked.

Attachments

SABackup.rar

(14.21 KiB) Downloaded 552 times

ROM.rar

(404 Bytes) Downloaded 652 times

RAM.rar

(6.12 KiB) Downloaded 605 times

[g0dzax]

So here are the screenshots from the Toshiba.


Quite interestingly, I do actually have sector acces and can write/read the sectors in user LBA, but that is the only things which you can edit. Everything else goes in that ABR error.


The most important notice, however, is the fact that the drive is detected automatically and it's ID IS read together with it's serial and firmware version. Yet if you look down below, the no. of cylinders is 0 and head also 0 with SPA numbered to N ( wth ? ). This implies that during it's power up you do have acces to the CP's ( at least CP 56 which holds the ID/serial/fw version), and you do have acces to user LBA, meaning you can write/read off the drive. Somehow, it doesn't sucessfully read the drive parameters though ( it doesn't recognize the no. of cylinders, spa , heads blah blah), meaning that the ROM itself is modified, not the CP's.

Attachments

[jermy]

meaning that the ROM itself is modified, not the CP's.

Most of the CP's is stored in ROM

[g0dzax]

What I meant to say is maybe the code is modified such that it accesses the CP in another way than the "normal" drives access the CP's.